Blog Post

Microsoft Entra Blog
1 MIN READ

Staged rollout to cloud authentication now in public preview

Alex_Simons's avatar
Alex_Simons
Icon for Microsoft rankMicrosoft
Oct 30, 2019

Howdy folks,

 

I’m excited to announce that the staged rollout to cloud authentication is now available in public preview. This feature allows you to migrate your users’ authentication from federation—via AD FS, Ping Federate, Okta, or any other federation on-premises system—to cloud authentication in a staged and controlled manner. More than 100 customers have used this feature to successfully cutover to cloud authentication during our private preview.

 

Moving your Azure AD authentication from federation on-premises to the cloud allows you to manage user and device sign-in from your control plane in Azure AD. You’ll benefit from reducing the dependency on on-premises infrastructure, which typically includes a farm of servers and proxies that need to be accessible from the internet. You won’t need to worry about patching of servers, availability and reliability of the authentication service, or managing ports on a firewall. In addition, you could also use staged rollout to move from a federated cloud identity provider to Azure AD authentication.

 

This helps you to avoid a cutover of your entire domain and selectively testing on a group of users to use cloud authentication capabilities like Azure Multi-Factor Authentication (MFA), Conditional Access, Identity Protection for leaked credentials, Identity Governance, and others.

 

Learn more

 

`

Alex Simons (@Alex_A_Simons )

Corporate VP of Program Management

Microsoft Identity Division 

Updated Jul 24, 2020
Version 8.0
Alex_Simons's avatar
Icon for Microsoft rankMicrosoft
Joined May 01, 2017
View Profile
Microsoft Entra Blog
Stay informed on how to secure access for employees, customers, and non-human identities, from anywhere, to multicloud and on-premises resources, with comprehensive identity and network access solutions powered by AI.

45 Comments

Sort By
Show More
  • Jithesh Raj (JR)'s avatar
    Jithesh Raj (JR)
    Icon for Microsoft rankMicrosoft
    Nov 01, 2019

    Daniel - yes this is not used for ADFS federations of apps. The feature is to only help you with Cloud Authentication of your Office 365 RelyingParty. After using staged rollout for a group of users, it would easier for you to switch from Office 365 federation with ADFS to cloud authentication. For migrating your apps from ADFS to AzureAD - look at this space

    https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/migrate-adfs-apps-to-azure

  • Cristian Calinescu's avatar
    Cristian Calinescu
    Brass Contributor
    Nov 01, 2019

    Does this apply if we wanted to migrate just from on-prem MFA server to the Azure cloud MFA? Are there any other requirements / prerequisites for doing this so the user will NOT have to re-register for MFA (keep the same user settings as configured on the on-prem MFA server) ? And the same question that Daniel Schmidt applies as well.

  • Daniel Schmidt's avatar
    Daniel Schmidt
    Brass Contributor
    Oct 31, 2019

    We already have our O365 auth switched to Passord Hash/SSO, however we still have  ton of 3rd party SAAS apps (ServiceNow for example) using ADFS, however they are setup to go to to the on-prem ADFS server directly, so in that cause I would not be able to use the Staged rollout since I have to work with the SAAS vendor to point to Azure AD instead of our ADFS server?  If so is there an easy way to migrate that?

  • Jithesh Raj (JR)'s avatar
    Jithesh Raj (JR)
    Icon for Microsoft rankMicrosoft
    Oct 30, 2019

    Micki Wulffeld - Yes, this is meant for production use and is only applied to the user who is enabled for staged rollout and not the entire federated domain. We had close to hundred customers who did this during private preview before they could cut over. You can reach out to me at jitheshr@microsoft.com if you have any questions.

  • Micki Wulffeld's avatar
    Micki Wulffeld
    Brass Contributor
    Oct 30, 2019

    Very cool. We are on the edge of dooing a cutover migration, but now we can try it out in the production enviroment before the cutover 🙂

    Alex Simons (AZURE)   are there any concerns of enabling the staged rollout in a production tenant?
    (It is a preview feature), but if only it is the experience of an migrated user that "may be" impacted of the preview statement. then i have no concerns?